CVE-2024-31444
published 2024-05-14CVE-2024-31444: Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in…
PriorityP434medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
14.66%
96.2th percentile
Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `automation_tree_rules_form_save()` function in `automation_tree_rules.php` is not thoroughly checked and is used to concatenate the HTML statement in `form_confirm()` function from `lib/html.php` , finally resulting in cross-site scripting. Version 1.2.27 contains a patch for the issue.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cacti | cacti | < 1.2.27 | 1.2.27 |
| cacti | cacti | >= 0 < 1.2.16+ds1-2+deb11u4 | 1.2.16+ds1-2+deb11u4 |
| cacti | cacti | >= 0 < 1.2.24+ds1-1+deb12u3 | 1.2.24+ds1-1+deb12u3 |
| cacti | cacti | >= 0 < 1.2.27+ds1-1 | 1.2.27+ds1-1 |
| cacti | cacti | >= 0 < 1.2.27+ds1-1 | 1.2.27+ds1-1 |
| cacti | cacti | >= 0 < 1.2.10+ds1-1ubuntu1.1 | 1.2.10+ds1-1ubuntu1.1 |
| cacti | cacti | >= 0 < 1.2.19+ds1-2ubuntu1.1 | 1.2.19+ds1-2ubuntu1.1 |
| cacti | cacti | >= 0 < 1.2.26+ds1-1ubuntu0.1 | 1.2.26+ds1-1ubuntu0.1 |
| cacti | cacti | >= 0 < 0.8.8b+dfsg-5ubuntu0.2+esm2 | 0.8.8b+dfsg-5ubuntu0.2+esm2 |
| cacti | cacti | >= 0 < 0.8.8f+ds1-4ubuntu4.16.04.2+esm2 | 0.8.8f+ds1-4ubuntu4.16.04.2+esm2 |
| cacti | cacti | >= 0 < 1.1.38+ds1-1ubuntu0.1~esm3 | 1.1.38+ds1-1ubuntu0.1~esm3 |
| debian | cacti | < cacti 1.2.24+ds1-1+deb12u3 (bookworm) | cacti 1.2.24+ds1-1+deb12u3 (bookworm) |
| fedoraproject | fedora | — | — |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
osv7.2HIGH
vendor_ubuntu9.1CRITICAL
vendor_debian4.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Cacti vulnerabilities
vendor_ubuntu·2024-08-20·CVSS 9.1
CVE-2024-29894 [CRITICAL] Cacti vulnerabilities
Title: Cacti vulnerabilities
Summary: Several security issues were fixed in Cacti.
It was discovered that Cacti did not properly apply checks to the "Package
Import" feature. An attacker could possibly use this issue to perform
arbitrary code execution. This issue only affected Ubuntu 24.04 LTS, Ubuntu
22.04 LTS, Ubuntu 20.04 LTS and Ubuntu 18.04 LTS. (CVE-2024-25641)
It was discovered that Cacti did not properly sanitize values when using
javascript based API. A remote attacker could possibly use this issue to
inject arbitrary javascript code resulting into cross-site scripting
vulnerability. This issue only affected Ubuntu 24.04 LTS. (CVE-2024-29894)
It was discovered that Cacti did not properly sanitize values when managing
data queries. A remote attacker could possibly use this iss
Debian
CVE-2024-31444: cacti - Cacti provides an operational monitoring and fault management framework. Prior t...
vendor_debian·2024·CVSS 4.6
CVE-2024-31444 [MEDIUM] CVE-2024-31444: cacti - Cacti provides an operational monitoring and fault management framework. Prior t...
Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `automation_tree_rules_form_save()` function in `automation_tree_rules.php` is not thoroughly checked and is used to concatenate the HTML statement in `form_confirm()` function from `lib/html.php` , finally resulting in cross-site scripting. Version 1.2.27 contains a patch for the issue.
Scope: local
bookworm: resolved (fixed in 1.2.24+ds1-1+deb12u3)
bullseye: resolved (fixed in 1.2.16+ds1-2+deb11u4)
forky: resolved (fixed in 1.2.27+ds1-1)
sid: resolved (fixed in 1.2.27+ds1-1)
trixie: resolved (fixed in 1.2.27+ds1-1)
OSV
cacti vulnerabilities
osv·2024-08-20·CVSS 7.2
CVE-2024-25641 [HIGH] cacti vulnerabilities
cacti vulnerabilities
It was discovered that Cacti did not properly apply checks to the "Package
Import" feature. An attacker could possibly use this issue to perform
arbitrary code execution. This issue only affected Ubuntu 24.04 LTS, Ubuntu
22.04 LTS, Ubuntu 20.04 LTS and Ubuntu 18.04 LTS. (CVE-2024-25641)
It was discovered that Cacti did not properly sanitize values when using
javascript based API. A remote attacker could possibly use this issue to
inject arbitrary javascript code resulting into cross-site scripting
vulnerability. This issue only affected Ubuntu 24.04 LTS. (CVE-2024-29894)
It was discovered that Cacti did not properly sanitize values when managing
data queries. A remote attacker could possibly use this issue to inject
arbitrary javascript code resulting into cross-si
OSV
CVE-2024-31444: Cacti provides an operational monitoring and fault management framework
osv·2024-05-14·CVSS 5.4
CVE-2024-31444 [MEDIUM] CVE-2024-31444: Cacti provides an operational monitoring and fault management framework
Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `automation_tree_rules_form_save()` function in `automation_tree_rules.php` is not thoroughly checked and is used to concatenate the HTML statement in `form_confirm()` function from `lib/html.php` , finally resulting in cross-site scripting. Version 1.2.27 contains a patch for the issue.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/Cacti/cacti/security/advisories/GHSA-p4ch-7hjw-6m87https://lists.fedoraproject.org/archives/list/[email protected]/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/https://github.com/Cacti/cacti/security/advisories/GHSA-p4ch-7hjw-6m87https://lists.debian.org/debian-lts-announce/2024/09/msg00027.htmlhttps://lists.fedoraproject.org/archives/list/[email protected]/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/
2024-05-14
Published